A-Lign targets Australian Government market with AssurePoint. Sydney Startup Brings Specialized Expertise in Australian Government Compliance Michael Novinson (MichaelNovinson) - September 22, 2026 A-Lign purchased an Australian startup led by a former Accenture consultant to address the compliance needs of organizations doing business with the Australian government. The Tampa, Florida-based cybersecurity compliance vendor said its buy of Sydney-based AssurePoint will allow A-Lign to serve the 6,000 companies looking to comply with Australia's Information Security Registered Assessors Program, according to A-Lign CEO Scott Price. He plans to use IRAP as the opening service in Australia, then offer capabilities around SOC 2, ISO 27001, ISO 42001 and penetration testing. "We did our homework around the addressable market, the buyer habits, etc., and saw that what we do and how we perform our work translates very well to the Australian market and, from the regulatory side of the Australian market as well, that it was something for us to lean into," Price told ISMG. AssurePoint, founded in August 2025, employs between 10 and 20 people and hasn't disclosed any outside funding. The company has been led since inception by Shaun Kumar, who had spent nearly three years as a security consulting manager at Accenture, 13 months as a cyber specialist in Australia's Department of Defense and five months as a cyber specialist in Australia's Department of Home Affairs (see: Hg Purchases A-Lign to Accelerate Cyber Compliance Growth). Why A-Lign wants to expand its footprint in Australia. After four years in the United Kingdom and Ireland, the EMEA market has the opportunity to reach about 35% of A-Lign's revenue, and Price said Australia offered another predominantly English-speaking market with a heavily regulated economy. The A-Lign-AssurePoint relationship began in March, and the deal was sole-sourced to A-Lign after AssurePoint spent six months learning A-Lign's vision for Australia. "Through our work and our customers in the U.K., we saw that more and more of them were doing business in Australia," Price said. "It's customer-driven for us as we look at where we should expand into." Unlike SOC 2 in the U.S. federal market, IRAP applies as a specific gateway for vendors that want to sell to the Australian government, and Price said AssurePoint stood out because IRAP was its core and only service rather than an ancillary offering. IRAP specifies how controls must be implemented, Price said, while SOC 2 and ISO 27001 are more risk-based and allow different controls to mitigate a given risk. "In Australia, if you want to sell to the federal government and unlock revenue, you need to go through IRAP," Price said. "There's about 6,000 companies globally that are looking to do that within the IRAP service market." AssurePoint customers currently use separate vendors at different times for IRAP, SOC 2, ISO work and penetration testing, which Price said fragments delivery and forces clients to submit the same evidence for repeated testing. By reusing a piece of data across multiple audits, Price said A-Lign will make delivery more efficient and reduce the burden of growing cybersecurity obligations for customers. "Our A-Scend technology platform allows us to identify these overlaps between SOC 2, ISO 27001 and IRAP," Price said. "If we can come in with one solution for the customer, we'll make it more efficient." How AssurePoint, A-Lign's compliance tools will come together. AssurePoint has deep experience defining IRAP engagements that help vendors qualify to do business with the Australian government, and Price views AssurePoint's expertise as the foundation and A-Lign's technology as an efficiency layer. A-Lign plans to preserve Australian elements of the service, and will apply its global framework while retaining a local feel for regulation and customer expectations. "If you start with poor-quality personnel, bringing technology won't help it," Price said. "Shuan [Kumar, AssurePoint CEO] has got a unique service delivery model that's a more customer-centric approach that uses people first and then allows them to become more efficient with technology." A-Lign plans to integrate AssurePoint's personnel and customers while building Australian demand for SOC 2 and ISO 27001, which Price expects will help AssurePoint triple its revenue between 2026 and 2027. The profile of a typical A-Lign or AssurePoint customer is an emerging, private equity-backed SaaS company seeking access to government agencies, financial services, or healthcare organizations, he said. "We actually have completed a crosswalk by looking at the IRAP controls typically in place, SOC 2 and ISO 27001 controls, and we see a great amount of overlap between the different frameworks," Price said. A-Lign wants Australia to become a launching point for the rest of APAC, and Price said the company will first grow its Australian operation before examining wider regional expansion. APAC is a high-demand but fragmented market, with local providers often serving domestic customers well but lacking global reach that multinationals want. A-Lign sees an opportunity to offer multiple frameworks on its own. "We are looking to take our global framework and our global focus on customer-centric services throughout the globe but possess a unique local feel from the regulatory standpoint, or more about how customers do business or expect to have business done in their individual countries," Price said.

A-LIGN acquires Pathfynder, adding offensive security depth for enterprises with complex security needs. Sep 01, 2026, 16:00 ET Veteran-owned elite cybersecurity team expands A-LIGN's ability to help organizations move beyond compliance and stay ahead of real-world attackers TAMPA, Fla., Sept. 1, 2026 /PRNewswire/ - A-LIGN, the leading cybersecurity compliance company, today announced its acquisition of Pathfynder, a specialized offensive and defensive cybersecurity firm. The acquisition expands A-LIGN's service offerings for enterprises looking to strengthen their security posture and reduce the risk of cyberattacks. The acquisition comes as enterprises face an increasingly costly, fast-moving, and AI-accelerated threat landscape. As attackers grow more sophisticated and persistent, compliance alone is no longer enough. Countering AI-enabled attacks takes both skilled people and advanced technology working together, and organizations need to know if their defenses can hold up against real adversaries. Pathfynder, a veteran-owned company, employs a team of elite specialists with decades of cybersecurity, military, and intelligence community experience. They provide technical offensive and defensive cybersecurity services including network, cloud, and web application penetration testing, red team and adversary emulation, testing of complex and emerging capabilities, and forensics and incident response. "Since our inception, A-LIGN has believed in the power of combined compliance and technical cybersecurity services under one roof," said Scott Price, CEO of A-LIGN. "The acquisition of Pathfynder enables A-LIGN to offer customers advanced offensive security services delivered by a team that operates independently from our assurance and assessment practice while leveraging institutional knowledge of the customer to enhance the cybersecurity services. Pathfynder will remain a highly experienced and specialized team under the A-LIGN parent brand, maintaining its brand as Pathfynder by A-LIGN. This structure preserves the independence between A-LIGN's assurance and assessment teams and Pathfynder's penetration testers to protect the integrity of both functions. For A-LIGN's more than 6,400 existing customers, it also means access to advanced, real-world security testing from a trusted partner, without the friction of managing another vendor relationship. "We are excited to join the A-LIGN team and bring our trusted expertise and proven capabilities to their existing suite of services," said DJ Fuller, founder of Pathfynder. "We share the same core values and mission: helping companies close security gaps and meet regulatory requirements, so they can reduce the risk of financial and reputational damage from a cyberattack." About A-LIGN A-LIGN is the leading cybersecurity compliance partner, trusted by over 6,400 organizations worldwide to navigate the complexities of compliance, audit, and risk. With a tech-enabled delivery model and deep domain expertise, A-LIGN has completed more than 36,000 audits. It is the #1 issuer of SOC 2 reports and a top three FedRAMP assessor. Founded in 2009, A-LIGN delivers high-quality, efficient audits across frameworks including SOC 2, ISO 27001, FedRAMP, CMMC, ISO 42001, PCI, and HITRUST. To learn more, visit: https://www.a-lign.com. SOURCE A-LIGN

A-LIGN and RealCISO partner to connect auditors directly into the compliance platform. Joint customers can run assessments, collect evidence from live systems, and work with their A-LIGN audit team in one place - no separate auditor portal, no evidence re-uploads BOSTON, MA - August 19, 2026 - RealCISO, the compliance intelligence platform used by more than 3,000 organizations, and A-LIGN, the cybersecurity compliance firm behind more than 36,000 audits for 6,400+ clients worldwide, today announced a strategic partnership that removes the most expensive handoff in compliance: the jump from "audit ready" to audited. Today, most organizations prepare for an audit in one platform, then export everything into the auditor's portal - re-uploading evidence, answering duplicate requests, and reconciling versions across two systems. That handoff adds weeks to every engagement and is the single biggest source of audit friction for security and compliance teams. This partnership eliminates it. As part of the rollout, A-LIGN auditors will work directly inside RealCISO: reviewing and accepting evidence, issuing follow-up requests, and communicating with the customer's team in the same platform where the compliance program already lives. The partnership delivers: * In-platform auditor connection. A-LIGN audit teams get scoped access inside RealCISO to review evidence, post requests, and resolve questions in-app - customers never leave the platform they work in every day. * Audit-grade functionality. Point-in-time revision snapshots seal assessment answers for defensible audit trails, evidence management tracks expiration and quality, and reports carry immutable version history. One evidence set maps across SOC 2, ISO 27001, HIPAA, NIST CSF 2.0, and other frameworks - no duplicate work per audit. * Evidence from live systems. RealCISO's newest release includes 15 integrations running 155 automated evidence collectors and 386 control tests on a 12-hour cadence - spanning AWS, Azure, Google Cloud, Microsoft 365, Google Workspace, Okta, Microsoft Intune, Jamf, Kandji, CrowdStrike, Qualys, Tenable, and ConnectWise. Auditors see evidence pulled from production systems, not screenshots collected months earlier. * One system, start to finish. From first assessment to final report, the entire engagement runs in a single platform - with AI-assisted evidence mapping doing the tedious work of linking uploads to controls. "Every compliance platform says 'audit ready.' Then the audit starts and your team spends six weeks re-uploading evidence into someone else's portal," said Brian Haugli, Co-Founder of RealCISO. "That's the part we're killing. With A-LIGN working inside RealCISO, the assessment, the evidence, and the auditor are finally in one system. Our customers keep working. A-LIGN gets evidence pulled straight from live systems - not a screenshot from three quarters ago." The in-platform auditor connection begins rolling out to joint RealCISO and A-LIGN customers as part of the partnership. About RealCISO RealCISO is a cloud-based compliance intelligence platform used by more than 3,000 organizations, including MSPs, MSSPs, vCISO consultants, and enterprise GRC teams. Built on a connected compliance data graph linking controls, risks, evidence, vendors, policies, and people, RealCISO tracks security maturity over time - not just point-in-time compliance status. RealCISO was named a G2 Summer 2026 High Performer and the #1-ranked vCISO platform. About A-LIGN A-LIGN is a cybersecurity compliance partner trusted by more than 6,400 organizations worldwide, with over 36,000 audits completed. A-LIGN is the #1 issuer of SOC 2 reports globally, a top-3 FedRAMP assessor, an authorized CMMC C3PAO, and a leading HITRUST assessor, delivering audits and assessments across SOC 1 and SOC 2, ISO 27001 and ISO 42001, HITRUST, HIPAA, PCI DSS, and federal frameworks through experienced auditors and its A-SCEND platform. Learn more at a-lign.com.